The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118669: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+N/A8.4 High0%Oct 28, 2026
CVE-2026-118538: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.12.05.5 Medium5.1 Medium0%Oct 28, 2026
CVE-2026-118537: n/a a2ui: A vulnerability was found in a2ui up to 0.10.44.3 Medium5.3 Medium0%Oct 28, 2026
CVE-2026-116641: MongoDB Database Tools: The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store6.8 Medium7.6 High0%Oct 28, 2026
CVE-2026-54453: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams7.2 HighN/A0%Oct 28, 2026
CVE-2026-93851: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the…8.0 HighN/A0%Oct 28, 2026
CVE-2026-118668: langchain-ai langgraph-api: langgraph-api implements the LangGraph API for rapid development and testingN/A8.6 High0%Oct 28, 2026
CVE-2026-118667: Improper Limitation of a Pathname to a Restricted Directory4.3 MediumN/A0%Oct 28, 2026
CVE-2026-118666: Exposure of Sensitive Information to an Unauthorized ActorN/A6.0 Medium0%Oct 28, 2026
CVE-2026-118665: Insufficient Session ExpirationN/A8.2 High0%Oct 28, 2026
CVE-2026-118664: Uncontrolled Resource ConsumptionN/A8.2 High0%Oct 28, 2026
CVE-2026-118663: Double Decoding of the Same Data5.3 MediumN/A0%Oct 28, 2026
CVE-2026-118662: Incorrect Behavior Order: Validate Before CanonicalizeN/A6.9 Medium0%Oct 28, 2026
CVE-2026-118661: Reliance on Cookies without Validation and Integrity Checking6.5 MediumN/A0%Oct 28, 2026
CVE-2026-118660: Server-Side Request Forgery (SSRF)8.6 HighN/A0%Oct 28, 2026
CVE-2026-118659: Server-Side Request Forgery (SSRF)7.5 HighN/A0%Oct 28, 2026
CVE-2026-118658: URL Redirection to Untrusted Site4.7 MediumN/A0%Oct 28, 2026
CVE-2026-118657: Origin Validation Error5.9 MediumN/A0%Oct 28, 2026
CVE-2026-118656: URL Redirection to Untrusted Site6.1 MediumN/A0%Oct 28, 2026
CVE-2026-78674: Improper Neutralization of Special Elements used in an OS Command8.8 HighN/A1%Oct 28, 2026
CVE-2026-76418: Unchecked Return Value to NULL Pointer Dereference8.6 HighN/A1%Oct 28, 2026
CVE-2026-6647: Insufficient Session Expiration7.4 HighN/A0%Oct 28, 2026
CVE-2026-63190: Missing Authentication for Critical Function9.4 CriticalN/A1%Oct 28, 2026
CVE-2026-61542: Missing Authentication for Critical Function8.6 HighN/A0%Oct 28, 2026
CVE-2026-61529: Server-Side Request Forgery (SSRF)4.7 MediumN/A0%Oct 28, 2026
1026-1050 of 413289